Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:36670
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain facebook.com designates 204.15.23.140 as permitted sender)
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----_=_NextPart_001_01C89141.55432DB3"
Date: Fri, 28 Mar 2008 19:06:27 -0700
Message-ID: <2EE58C11758A3C4A929C8FFE3779827F2119FF@Sf2pmxb04.TheFacebook.com>
Thread-Topic: references / zend_assign_to_variable / IS_CONST operands in APC
Thread-Index: AciRQX+P8i5UBPjLR5OvW0BrnHt10Q==
To: <internals@lists.php.net>
Subject: references / zend_assign_to_variable / IS_CONST operands in APC
From: Kannan@facebook.com ("Kannan Muthukkaruppan")

------_=_NextPart_001_01C89141.55432DB3
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Consider the following small test case where $y is first made to be a
reference to $x. And next, we assign a literal to $y.
=20
Example #1:
<?php
=20
$x =3D 5;
$y =3D &$x;

$y =3D null;  <---
=20
When we come to the third assignment statement above we try to increase
(followed quickly by a decrease) of the "refcount" on the right hand
side ZVAL (the null zval) in the following piece of code in
zend_assign_to_variable():
=20
=20
 } else if (PZVAL_IS_REF(variable_ptr)) {
  if (variable_ptr!=3Dvalue) {
   zend_uint refcount =3D variable_ptr->refcount;
   zval garbage;
=20
   if (type!=3DIS_TMP_VAR) {
    value->refcount++;                 <----- incrementing the refcount
of RHS zval
   }
   garbage =3D *variable_ptr;
   *variable_ptr =3D *value;
   variable_ptr->refcount =3D refcount;
   variable_ptr->is_ref =3D 1;
   if (type!=3DIS_TMP_VAR) {
    zendi_zval_copy_ctor(*variable_ptr);
    value->refcount--;                   <------ and then decrementing
it back...
   }
   zendi_zval_dtor(garbage);
  }
 }
=20
I am trying to understand the rationale for value->refcount++ and
value->refcount-- above. Why do we need that?
=20
With PHP running in apache+APC environment, the "null" literal is an
IS_CONST operand in the op_array in APC (shared memory). And
incrementing/decrementing a ref count on the shared memory area without
a mutex can cause unexpected problems due to race conditions (and
eventually lead to memory corruptions etc.)
=20
Recall that zend_opcode.c:pass_two() sets "is_ref" on all IS_CONST
operands to 1, as a way to allow op_arrays to be sharable across
processes. And indeed, in the simpler case of an assignment such as in
the following example (#2), zend_assign_to_variable() notices that the
RHS has "is_ref" set and goes on to make a copy (rather than
incrementing the RHS's refcount).
=20
Example #2:
=20
<?php
$a =3D 5;
=20
But in the case the LHS is itself an "is_ref" (like in the example #1)
it doesn't seem to make a similar check on the RHS (to see if it is safe
to modify the refcount on the RHS). Why?
=20
=20
regards,
Kannan

------_=_NextPart_001_01C89141.55432DB3--